# Generate a realistic self-signed DSC for testing the CBSnexora helper.
#
# Replaces the UUID-CN bare-bones dev cert with one that has:
#   - Real-looking subject DN: CN=Test User, O=CBSnexora Pvt Ltd, OU=IT, L=Mumbai, ST=Maharashtra, C=IN
#   - KeyUsage = DigitalSignature (matches real Indian Class 3 DSCs)
#   - Strong private-key protection enabled — Windows pops a PIN dialog at creation time, then
#     prompts you for that PIN on every signing operation (matches the UX of a real USB token).
#
# Run from PowerShell (no elevation needed; user store only):
#   .\generate-test-dsc.ps1
#
# Why certreq + INF instead of New-SelfSignedCertificate:
#   New-SelfSignedCertificate (Windows PowerShell 5.x) doesn't expose ProtectKey / strong-protection
#   knobs — it creates a CNG/KSP key that won't prompt. certreq.exe with an INF using the legacy
#   "Microsoft Enhanced RSA and AES Cryptographic Provider" CSP IS the supported path for forcing
#   user-confirmation on key access.

$ErrorActionPreference = "Stop"

Write-Host "=== Step 1: Clean up old UUID-CN test certs from Windows-MY ===" -ForegroundColor Cyan
$old = Get-ChildItem Cert:\CurrentUser\My | Where-Object {
    $_.Subject -match "^CN=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
}
if ($old) {
    Write-Host "Found $($old.Count) old UUID-CN cert(s) - removing:" -ForegroundColor Yellow
    foreach ($c in $old) {
        Write-Host "  $($c.Thumbprint)  $($c.Subject)"
        Remove-Item "Cert:\CurrentUser\My\$($c.Thumbprint)" -Force
    }
} else {
    Write-Host "No old UUID-CN test certs in the user store."
}

Write-Host ""
Write-Host "=== Step 2: Build INF for certreq ===" -ForegroundColor Cyan

# Random container name avoids collisions when the script is re-run before old containers expire.
$containerName = "CBSnexora-DSC-Test-$(Get-Random -Maximum 999999)"
$inf = @"
[Version]
Signature = "`$Windows NT`$"

[NewRequest]
Subject = "CN=Test User, OU=IT Department, O=CBSnexora Pvt Ltd, L=Mumbai, ST=Maharashtra, C=IN"
KeyAlgorithm = RSA
KeyLength = 2048
KeyUsage = "CERT_DIGITAL_SIGNATURE_KEY_USAGE"
MachineKeySet = false
KeyContainer = "$containerName"
ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
KeySpec = AT_SIGNATURE
ProtectKey = true
SMIME = false
RequestType = Cert
Exportable = false
HashAlgorithm = SHA256
ValidityPeriod = Years
ValidityPeriodUnits = 2

[Extensions]
2.5.29.37 = "{text}1.3.6.1.5.5.7.3.4"
"@

$infPath = Join-Path $env:TEMP "cbsnexora-test-dsc.inf"
$cerPath = Join-Path $env:TEMP "cbsnexora-test-dsc.cer"
$inf | Out-File -FilePath $infPath -Encoding ASCII -Force
Write-Host "INF written to $infPath"

Write-Host ""
Write-Host "=== Step 3: certreq -new ===" -ForegroundColor Cyan
Write-Host "WINDOWS WILL POP A DIALOG asking 'Creating an RSA exchange key':" -ForegroundColor Yellow
Write-Host "  -> Click 'Set Security Level...'"                                -ForegroundColor Yellow
Write-Host "  -> Select 'High'"                                                -ForegroundColor Yellow
Write-Host "  -> Click 'Next', then set a PIN you'll remember"                 -ForegroundColor Yellow
Write-Host "  -> Click 'Finish' then 'OK'"                                     -ForegroundColor Yellow
Write-Host ""

& certreq.exe -new $infPath $cerPath
if ($LASTEXITCODE -ne 0) {
    Write-Error "certreq -new failed with exit code $LASTEXITCODE"
    exit $LASTEXITCODE
}

Write-Host ""
Write-Host "=== Step 4: New cert summary ===" -ForegroundColor Cyan
$new = Get-ChildItem Cert:\CurrentUser\My | Where-Object {
    $_.Subject -like "*CN=Test User*"
} | Sort-Object NotBefore -Descending | Select-Object -First 1

if ($new) {
    Write-Host "Subject:     $($new.Subject)"     -ForegroundColor Green
    Write-Host "Issuer:      $($new.Issuer)"
    Write-Host "Serial:      $($new.SerialNumber)"
    Write-Host "Thumbprint:  $($new.Thumbprint)"
    Write-Host "Valid From:  $($new.NotBefore)"
    Write-Host "Valid Until: $($new.NotAfter)"
    Write-Host "KeyUsage:    $($new.Extensions | Where-Object { $_.Oid.Value -eq '2.5.29.15' } | ForEach-Object { $_.KeyUsages })"
} else {
    Write-Warning "Cert created but not findable - check certmgr.msc -> Personal -> Certificates"
}

# Cleanup temp files
Remove-Item $infPath -Force -ErrorAction SilentlyContinue
Remove-Item $cerPath -Force -ErrorAction SilentlyContinue

Write-Host ""
Write-Host "=== Done ===" -ForegroundColor Green
Write-Host "Next:"
Write-Host "  1. Clear JWS cache:"
Write-Host "     Remove-Item -Recurse -Force `"`$env:USERPROFILE\.cache\icedtea-web`""
Write-Host "  2. Trigger DSC enroll from the web UI."
Write-Host "  3. Pick 'Test User' from the cert table - now shows real Holder Name and Organisation."
Write-Host "  4. Windows pops the PIN prompt; enter the PIN you set above. Helper proceeds to enroll."